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(54) Abstract Trtle 

Detecting changes in a customer's behaviour profile 

(57) Apparatus and methods for monitoring the behaviour of variable-behaviour units, such as for 
monitoring human behaviour, are described, in one particular example, the behaviour of customers to a 
wireless telephone network is monitored. For each customer a predetermined behaviour profile, or behaviour 
region within a total 'customer behaviour space', is stored in a customer profile store (20). Calls made by 
customer in the network (12) are fed to a call analyser (14) which also receives inputs from a profile definition 
store (16) storing the definitions of different possible behaviour patterns or behaviour regions. Over a period 
of time, the current behaviour profile of a particular customer is determined and output to a transition detector 
(18) where it is compared with the pre-stored customer behaviour profile. The transition detector (18) detects 
any transition between the customer's current behaviour profile and the pre-stored profile, and any such 
detected transition is passed to a transition processor (22). This operates under control of a transition rule 
store (24) which stores data indicating which particular transitions are acceptable and which are not. Any that 
are not acceptable cause an alert to be produced by an alarm processor (26). In addition, an adaptation system 
(28) responds to the data from the call analyser (14), the transition detector (18), and the transition processor 
(22) to carry out adaptations of the data in the profile definition store (16), the customer profile store (20) and 
the transition rule store (24). 
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APPAP ATI IS AND M ETHODS FOR RF.HAVTOT JR PROFILING 
The invention relates to apparatus and methods for behaviour profiling. Apparatus and 
methods according to the invention, and to be described in more detail below by way of 
example only, are for monitoring the behaviour of customers in a telecommunication 
network, such as a cellular telephone network. However, they may be used in many other 
applications. 

According to the invention, there is provided apparatus for classifying and monitoring the 
behaviour of each of a plurality of variable-behaviour units, comprising a data store for 
storing data representing definitions of a plurality of different predetermined patterns of 
behaviour, means for classifying each of the units into one of the predetermined patterns 
of behaviour according to the previously determined behaviour of that unit, behaviour 
monitoring means for monitoring the current behaviour of each unit, and comparing 
means for comparing the current behaviour of each unit with the predetermined behaviour 
pattern corresponding to that unit for detecting changes in behaviour patterns. 

According to the invention, there is also provided apparatus for monitoring calls made by 
customers in a wireless telephone network, comprising means defining a plurality of 
different predetermined calling patterns appropriate to different types of customers to the 
network, means for allocating each customer to a particular one of the predetermined 
calling patterns according to their respective previously determined calling patterns, 
means for monitoring calls to the network and for determining for each customer the 



current one of the predetermined calling patterns which is appropriate to that customer, 
transition detecting means for comparing the current calling pattern of a particular 
customer with the previously determined calling pattern for that customer and for 
detecting any difference in the compared calling patterns thereby to record a transition by 
the customer from the previously determined calling pattern to the current calling pattern, 
and transition processing means responsive to any said transition for a particular customer 
whereby to produce an alert in response to certain transitions and not in response to other 
transitions. 

According to the invention, there is further provided a method of classifying and 
monitoring the behaviour of each of a plurality of variable-behaviour units, comprising 
the steps of storing data representing definitions of a plurality of different predetermined 
patterns of behaviour, classifying each of the units into one of the predetermined patterns 
of behaviour according to the previously determined behaviour of that unit, monitoring 
the current behaviour of each unit, and comparing the current behaviour of each unit with 
the predetermined behaviour pattern corresponding to that unit for detecting changes in 
behaviour patterns. 

According to the invention, there is yet further provided a method of monitoring calls 
made by customers in a wireless telephone network, comprising the steps of defining a 
plurality of different predetermined calling patterns appropriate to different types of 
customers to the network, allocating each customer to a particular one of the 



predetermined calling patterns according to their respective previously determined calling 
patterns, monitoring calls to the network and determining for each customer the current 
one of the predetermined calling patterns which is appropriate to that customer, 
comparing the current calling pattern of a particular customer with the previously 
determined calling pattern for that customer and detecting any difference in the compared 
calling pattern thereby to record a transition by the customer from the previously 
determined calling pattern to the current calling pattern, and responding to any said 
transition for a particular customer whereby to produce an alert in response to certain 
transitions and not in response to other transitions. 

Apparatus and methods according to the invention, for profiling the behaviour of 
customers of a cellular telephone network, will now be described, by way of example 
only, with reference to the accompanying drawings in which: 

Figure 1 is a diagram showing different possible behaviour patterns; and 

Figure 2 is a diagram of one form of the apparatus 

For many purposes, it is desirable to monitor patterns of human behaviour, such as for 
commercial purposes or for purposes of safety or security or for the detection of fraud. 
More specifically, it may be desirable to monitor changes in patterns of behaviour, 
because such changes may have commercial or security implications. A particular 



example where the monitoring of changes in patterns of behaviour is of potential 
significance is in telecommunications or telephone systems. A customer of a telephone 
network is identified to the network by the customer's telephone number (or by some 
identification derived from, or from which the telephone number is derived) even though 
it may be that the actual identity of the subscriber is not known (such as in the case of a 
pre-paid customer in the cellular telephone system). The telephone network can monitor 
the general "pattern" of calls made by the customer in the network - that is the general 
type of calls (for example, called destinations) and their time distribution (that is, the 
times of day and the days of the week when the customer makes most calls). It is 
desirable to be able to detect changes in such behaviour patterns, because this may 
indicate commercial possibilities to the network operator (for example, the customer 
could be offered a different tariff) or may suggest fraudulent activity within the network - 
in particular in the case of a wireless or cellular telephone network, that the customer's 
telephone handset has been stolen and is being fraudulently mis-used by someone else. 

Figure 1 shows at A a "Customer Behaviour Space" which is considered to embrace all 
possible calling patterns of a customer in a telecommunications network which, for the 
sake of example, will be considered to be a cellular telephone network. The space A is 
sub-divided into a number of regions B, C, D, E, F, G, H, I, J, K. Each region represents 
the behaviour pattern of a particular group of customers of the network. Customers may 
be grouped, according to well-defined calling criteria, into such groups as "Pensioner", 
"Student", "Premium-Rate", "Business", "International Business", '•Normal" and others. 



By monitoring the pattern of called numbers of each customer over a period of time, it is 
possible for the network to allocate each customer to a particular group or corresponding 
region - that is, so that each customer falls within a particular one of the regions B to K 
in the customer behaviour space A of Figure 1. In accordance with a feature of the 
invention, the network monitors the customer behaviour to detect changes or divergencies 
- that is, changes in a customer's behaviour such that the behaviour no longer falls within 
the region to which that customer's behaviour has been allocated. However, in 
accordance with the invention, the network does not merely respond when the behaviour 
of a particular customer falls outside the customer's "normal" region, but responds 
according to the type of the change or transition in behaviour. Thus, some transitions 
(behaviour changes from one region into another) may be acceptable (that is, not 
generating an alert or feedback) whereas others may not be acceptable and may indicate 
an abnormal behaviour, giving rise to an alert or feed back. Such an alert or feedback 
may be indicative of fraudulent mis-use of the customer's handset (e.g. after theft). 
However, this is not necessarily so; it may simply indicate a genuine change in customer 
behaviour (for example, if a student's studies have finished and the student has now taken 
up employment requiring telephone use for business purposes). In another example, a 
pensioner's normal telephone use might embrace occasional international telephone calls 
at weekends or evenings. However, sudden and frequent use of such a customer's 
telephone for international calls (eg. to North America) during business hours would 
indicate a transition to an "International Business" region, and such a transition might be 
deemed to be unacceptable and give rise to an alert. 



In accordance with another feature of the invention, the monitoring of transitions can also 
be used to optimise and refine the rules which define the boundaries between the regions. 
A large number of transitions between two regions may indicate that the boundary 
between them is incorrectly defined. A few transitions may indicate that one or more 
additional regions is required. 

Figure 2 shows a call monitoring system 10. The call monitoring system 10 is fed with 
a flow of call records from the telephone network 12. Each call record will indicate the 
customer's identity (not necessarily their actual identity but at least their identity within 
the network - their telephone number or IMSI), the called number for each call, the 
time/day of the call and its length. 

The call records are received by a call analyser 14 which analyses all call records received 
over a period of time Tl. The call analyser also receives inputs from a profile definition 
store 16, which defines different patterns of customer behaviour corresponding to the 
different region (B to K, see Figure 1). Over a period of time T2, the call analyser 14 uses 
the inputs from the profile definition store 16 to classify the current behaviour of each 
customer and outputs the result to a transition detector 18. The transition detector 18 
receives inputs from a customer profile store 20. This stores the profile, or region, 
previously allocated to each customer. Therefore, the transition detector 18 can detect 
any transition which has taken place (during the time T2) for a particular customer, by 
comparing the customer's current profile or region from the call analyser 14 with the 



stored customer profile or region from the customer profile store 20. The detected 
transitions are fed to a transition processor 22. This operates under control of a transition 
rule store 24. This stores rules concerning 'permissible' and 'impermissible' transitions. 
Thus, the transition processor 22 compares any transition detected, for a particular 
customer, by the transition detector 18 with the output from the transition rule store 24 - 
to determine whether or not to produce an alarm. Any alarm signal is passed to an alarm 
processor 26 for appropriate action by the network operator. 

As already explained, an alarm could indicate fraudulent mis-use of customers telephone 
handset. Instead though, it could indicate a change in a customer's behaviour which 
could act as a trigger for offering new services to the customer. 

An adaptation system 28 receives several inputs. For example, it receives inputs from the 
call analyser 14 representative of the current profile or behaviour region detected for each : 
customer. It also receives inputs from the transition detector 18 indicative of detected 
transitions, and the alarm outputs from the transition processor 22. The adaptation system 
28 uses these inputs over a period of time T3 to determine whether modification of the 
data stored in the profile definition store 16, the customer profile store 20 and the 
transition rules store 24 should be adapted. Thus, for example, as already explained, the 
existence of many transitions (as detected by the transition detector 18) may cause the 
adaptation system 28 to change the definitions of some or all of the behaviour regions, by 
changing the data stored in the profile definition store 16. 
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If outputs from the call analyser 14 repeatedly show that a particular customer is now 
operating in a particular behaviour region which is different from the one stored in the 
customer profile store 20, the adaptation system responds by changing the data in the 
profile store 20 in order to re-classify that customer into a different region. Similarly, the 
adaptation system 28 may change the definition of the rules in the transition rules store 
24 (for example, in response to changes in the definitions of the behaviour region). 

The length of time Tl may be varied according to the precision of monitoring required. 
T2 should be not more that Tl, in order to enable real-time monitoring and to ensure that 
transitions are not missed. T3 should be much greater than Tl (e.g. 100 times greater) 
otherwise the system will become unstable. 

Although the invention has been specifically described with reference to the classification 
of customer behaviour in a telephone network, it may be used in other applications, not 
concerned with telecommunications, where customer behaviour can be readily monitored. 



CLAIMS 



Apparatus for classifying and monitoring the behaviour of each of a plurality of 
variable-behaviour units, comprising a data store for storing data representing 
definitions of a plurality of different predetermined patterns of behaviour, means 
for classifying each of the units into one of the predetermined patterns of 
behaviour according to the previously determined behaviour of that unit, behaviour 
monitoring means for monitoring the current behaviour of each unit, and 
comparing means for comparing the current behaviour of each unit with the 
predetermined behaviour pattern corresponding to that unit for detecting changes 
in behaviour patterns. 

Apparatus according to claim 1, in which the behaviour monitoring means at least 
temporarily classifies the current behaviour of the unit into one of the 
predetermined behaviour patterns, and in which the comparing means compares 
the patterns of a particular unit's current behaviour with the predetermined 
behaviour pattern to which it is previously allocated. 

Apparatus according to claim 2, in which the comparing means comprises means 
for detecting when the behaviour pattern for the current behaviour of a particular 
unit is different from the previously allocated behaviour pattern for that unit and 
for determining a transition accordingly which is dependant upon the two 
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behaviour patterns, and including transition processing means for comparing each 
transition with predetermined data corresponding to the various possible 
transitions whereby to produce an alert in response to certain transitions and not 
in response to other transitions. 

Apparatus according to claim 2 or 3, including adaptation means responsive to 
data relating to the current behaviour pattern of a variable-behaviour unit for 
changing the previously allocated behaviour pattern for that unit. 

Apparatus according to claim 3, including adaptation means responsive to data 
representing the current behaviour pattern of a particular variable-behaviour unit 
and to data representing said transitions for changing the definitions of the 
behaviour patterns. 

Apparatus according to claim 3, including adaptation means responsive to data 
representing the current behaviour pattern of a particular variable-behaviour unit, 
to data representing said transitions, and to data representing said alerts, for 
changing the transitions which produce the alerts. 

Apparatus according to any preceding claim, in which each variable-behaviour 
unit is a living organism. 
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Apparatus according to claim 7, in which the living organism is a human. 

Apparatus according to claim 8, in which the human is a customer in a 
telecommunications network. 

Apparatus according to claim 9, in which the network is a wireless telephone 
network. 

Apparatus according to claim 10, in which each behaviour pattern is a telephone 
call pattern relating to a particular type of customer. 

Apparatus for monitoring calls made by customers in a wireless telephone 
network, comprising means defining a plurality of different predetermined calling 
patterns appropriate to different types of customers to the network, means for 
allocating each customer to a particular one of the predetermined calling patterns 
according to their respective previously determined calling patterns, means for 
monitoring calls to the network and for determining for each customer the current 
one of the predetermined calling patterns which is appropriate to that customer, 
transition detecting means for comparing the current calling pattern of a particular 
customer with the previously determined calling pattern for that customer and for 
detecting any difference in the compared calling patterns thereby to record a 
transition by the customer from the previously determined calling pattern to the 
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current calling pattern, and transition processing means responsive to any said 
transition for a particular customer whereby to produce an alert in response to 
certain transitions and not in response to other transitions. 

Apparatus according to claim 12, in which the transition processing means 
compares each said transition with the predetermined data classifying each of all 
possible transitions into a respective one of at least two types, whereby to produce 
an alert if the transition is of the first type and not to produce an alert if the 
transition is of the second type. 

Apparatus according to claim 12 or 13, including adaptation means responsive to 
data representing determinations of a customer's current calling pattern for 
changing the previously determined calling pattern for that customer. 

Apparatus according to claim 13, including adaptation means responsive to data 
representing determinations of a particular customer's current calling pattern and 
to data representing said transitions by that customer for adjusting the 
predetermined data classifying all possible transactions. 

A method of classifying and monitoring the behaviour of each of a plurality of 
variable-behaviour units, comprising the steps of storing data representing 
definitions of a plurality of different predetermined patterns of behaviour, 
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classifying each of the units into one of the predetermined patterns of behaviour 
according to the previously determined behaviour of that unit, monitoring the 
current behaviour of each unit, and comparing the current behaviour of each unit 
with the predetermined behaviour pattern corresponding to that unit for detecting 
changes in behaviour patterns. 

17. A method according to claim 1 6, in which the monitoring step at least temporarily 
classifies the current behaviour of the unit into one of the predetermined behaviour 
patterns, and in which the comparing step compares the patterns of a particular 
unit's current behaviour with the predetermined behaviour pattern to which it is 
previously allocated. 

18. A method according to claim 1 7, in which the comparing step comprises the steps 
of detecting when the behaviour pattern for the current behaviour of a particular 

s. . i unit is different from the previously allocated behaviour patterns for that unit and 

for determining a transition accordingly which is dependant upon the two 
behaviour patterns, and including the step of comparing each transition with 
predetermined data corresponding to the various possible transitions whereby to 
produce an alert in response to certain transitions and not in response to other 
transitions. 



19. A method according to claim 17 or 18, including the step of responding to data 
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relating to the current behaviour pattern of a variable-behaviour unit for changing 
the previously allocated behaviour pattern for that unit. 

20. A method according to claim 18, including the step of responding to data 
representing the current behaviour pattern of a particular variable-behaviour unit 
and to data representing said transitions for changing the definitions of the 
behaviour patterns. 

21. A method according to claim 18, including the step of responding to data 
representing the current behaviour pattern of a particular variable-behaviour unit, 
to data representing said transitions, and to data representing said alerts, for 
changing the transitions which produce the alerts. 

22. A method according to any one of claims 16 to 21, in which each variable- 
behaviour unit is a living organism. 

23. A method according to claim 21, in which the living organism is a human. 

24. A method according to claim 23, in which the human is a customer in a 
telecommunications network. 

25. A method according to claim 24, in which the network is a wireless telephone 
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network. 

26. A method according to claim 25, in which each behaviour pattern is a telephone 
call pattern relating to a particular type of customer. 

27. A method of monitoring calls made by customers in a wireless telephone network, 
comprising the steps of defining a plurality of different predetermined calling 
patterns appropriate to different types of customers to the network, allocating each 
customer to a particular one of the predetermined calling patterns according to 
their respective previously determined calling patterns, monitoring calls to the 
network and determining for each customer the current one of the predetermined 
calling patterns which is appropriate to that customer, comparing the current 
calling pattern of a particular customer with the previously determined calling 
pattern for that customer and detecting any difference in the compared calling 
pattern thereby to record a transition by the customer from the previously 
determined calling pattern to the current calling pattern, and responding to any said 
transition for a particular customer whereby to produce an alert in response to 
certain transitions and not in response to other transitions. 

28. A method according to claim 27, in which the step of responding to any said 
transition for a particular customer compares each said transition with determined 
data classifying each of all possible transitions into a respective one of at least two 
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types, whereby to produce an alert if the transition is of the first type and not to 
produce an alert if the transition is of the second type. 

Apparatus for monitoring the calling behaviour of customers in a 
telecommunications network, substantially as described with reference to the 
accompanying drawings. 

A method of monitoring the calling patterns of customers in a telecommunications 
network, substantially as described with reference to the accompanying 
diagrammatic drawings. 
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